Open directory listings: Crawl Audit check 162

Short answer: if a folder has no index page, some servers show a list of every file in it instead. That can expose files you never linked to, such as old uploads, exports or backups. Check 162 tests one folder in the full audit.

What Crawl Audit checks

• It runs only in the full audit, and only when the site owner has agreed to it. The free check shows that it runs in the full report.
• It picks the folder of a file your homepage already loads (or /assets/) and requests it.
• Fail: the response is an "Index of /" listing.
• Pass: no listing.

One folder is a sample. Try your uploads, images and downloads folders yourself.

What the sources say

• MITRE CWE-548: the weakness is when a site "inappropriately exposes a directory listing with an index of all the resources located inside of the directory." And: "The directory listing may also compromise private or confidential data."
• Apache: with the Indexes option on, if a folder has no index file, "mod_autoindex will return a formatted listing of the directory."
• nginx: listings are off unless you turn them on. The default is autoindex off;

Switching it off

• Apache (in the site config or .htaccess): Options -Indexes
• nginx: remove any autoindex on; line.
• Many hosts have a "directory browsing" or "indexes" switch in the control panel.

Then check what was exposed. If a listing was public, assume the files in it were seen.

On devmarde.com

The folder Crawl Audit would test on our site returned a 404 on 6 October, with no listing. It passes.

Sources

• MITRE, CWE-548: Exposure of information through directory listing.
• Apache, Options directive, and nginx, autoindex module, checked 6 October 2026.